CrowdSecLive Exploit Tracker
Background NoiseCVE-2021-24931Public Exploit

Secure Copy Content Protection and Content Locking WordPress plugin - SQLi (CVE-2021-24931)

PublishedDec 6, 2021
First SeenFeb 6, 2025
Last Seen
Reported
CVSS9.8
AP
Ays ProSecure Copy Content Protection and Content Locking
cmswordpress

Description

The Secure Copy Content Protection and Content Locking WordPress plugin before 2.8.2 does not escape the sccp_id parameter of the ays_sccp_results_export_file AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an SQL injection.

psychologyCrowdSec Analysis

CVE-2021-24931 is a critical vulnerability in the Secure Copy Content Protection and Content Locking WordPress plugin that allows unauthenticated SQL injection through improper handling of input parameters in an AJAX action.

CrowdSec has been tracking this vulnerability and its exploits since 5th of February 2025.

CrowdSec network data shows that most actors exploiting CVE-2021-24931 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. In addition, according to the CrowdSec network, attack volume against CVE-2021-24931 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Observed attacks commonly focus on requests involving the /wp-admin/admin-ajax.php endpoint with an export-related action.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2021-12-06
Rule Released2025-02-05
CrowdSec First Seen2025-02-06

Related Weaknesses

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References